Hacker News Reader

Comment by UI_at_80x24 | Hacker News Reader

Back in my BBS days I would use ALT+255 to create a <null> blank character. Windows couldn't display it, but the FTP programs I used could. That made it fun/easy to "hide" an FTP server dump location on a windows server.

The windows admin could see that the drive was filling up but not which directory was the cause.

Linux could see it. And so could my FTP client. (Enter fond memories of using FXP here too)

For multiple layers of chaos I might create multiple "blank" directories but only store the 'real' files multiple layers deep. For added "legitimacy" I might include the contents of \system or \print or something. I can't remember exactly.

View on HN

We used the Alt+255 trick in my high school computer lab (windows 3.1) to hide games like Doom and Descent. It worked great because for some reason, if I recall correctly, the `dir /s` command would not traverse into directories with that name, so recursive directory searches for "DOOM.EXE" would turn up nothing. Also, folders with that name wouldn't appear in Windows.

To break out of the managed environment, someone figured out they could hit Ctrl+Break at the text-mode login screen - this would drop you to a DOS prompt. But the lab admin got wise to that and blocked that key combination.

I figured out a workaround: Alt+3. It would send an ASCII code that the input would interpret identically to Ctrl+Break, and we were back in business :-)

I'm somewhat skeptical about folders not appearing, the Alt+255 character is just a non-breaking space, and should display as such: the name will appear to be blank, but with a clickable folder icon.

However, I can confirm that DIR /S doesn't enter directories starting with that character - TIL!

From reading the source code[1], this happens because it requires the name to be alphabetically below something called the "temp name", which is initialized to start with this character.

What the code seems to be doing is selection sort, finding the first (alphabetically lowest) subdirectory that hasn't been entered yet, by reading the entire directory each time and comparing all the names. Not very efficient, but excusable if it saved some memory.

[1] https://github.com/Hengle/ms_dos_6_0_source_code/blob/master... -- temp name init is at line 1767

As far as I remember (I also used the Alt+255 trick at the high school to hide stuff), Windows 3.1 could not open folders containing the blank 255 character, which was displayed as an underscore for some reason, and not properly translated to the windows code point for the same character (160). So it was not possible to open those folders, although they were visible in the File manager.

Yeah, just checked- this is correct. They appear, but with an underscore, and they can't be navigated to or deleted from within the UI.

Really interesting! There is leaked source code for WINFILE from NT 3.5, maybe the answer for why this happens can be found in there: https://github.com/Hengle/windows_nt_3_5_source_code/tree/ma...

(anyone working on ReactOS or Wine probably shouldn't click this link...)

Microsoft released the NT 4 version of it under the MIT license: https://github.com/microsoft/winfile

I'd rather suspect the Windows API behind for this behavior, rather than the file manager itself. Apparently there might be leaked Windows 3.1 source code (but not all of it): https://www.betaarchive.com/forum/viewtopic.php?t=41781 (only comments here, didn't check further to see if/where this can be downloaded), but not sure if the relevant source is visible there. Windows 3.1 doesn't seem to use the same conversion as for Alt+XXX to read file names (which are stored in the OEM charset on the disk, e.g. code page 437), as typing Alt+255 enters a normal space (not event a non-breaking one).

You are right, it's likely to be the conversion from OEM to ANSI. In that case, NT wouldn't have the same bug, since it uses Unicode internally (and the tables translate OEM character 255 to U+00A0).

The forum post seems to be about this directory in the leaked 3.5 source: https://github.com/Hengle/windows_nt_3_5_source_code/tree/ma...

Great question, what would happen if NT sees a FAT filesystem (therefore with 8.3 names stored in OEM charset) with a filename containing a Alt+255 (0xFF) character? Anybody with a ready VM around to test this?

Quickly had a look in the KERNEL31 source. The LDOPEN.ASM file contains calls to a routine called MyOemToAnsi, which does the character set conversion. In turn, that function either calls the actual conversion routine in the keyboard driver, or does nothing if there's no keyboard driver yet (boot phase). Didn't find the keyboard driver part, probably not part of the actual kernel so it makes sense that it's not there. Anyone knows where to find one?

When I first got on the 'Net in '94 I joined a pirate group and my job was to find open writeable folders on FTP sites and then try to make the most obscure invisible folder names containing null chars, ^H, and other control codes so that they were practically impossible to get into with the tools available at the time if you didn't know the string.

> Linux could see it.

Oh we had stuff for the linux sysadmins too. ^H was easy mode, throw in some VT control codes in there and you had a dir that NOBODY could navigate to without the code.

Reply on news.ycombinator.com